Publish Advisories

GHSA-h8cp-697h-8c8p
GHSA-mcxq-54f4-mmx5

Author: advisory-database[bot]

advisories/github-reviewed/2025/12/GHSA-h8cp-697h-8c8p/GHSA-h8cp-697h-8c8p.json

@@ -0,0 +1,64 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-h8cp-697h-8c8p",
+  "modified": "2025-12-03T17:00:03Z",
+  "published": "2025-12-03T17:00:03Z",
+  "aliases": [
+    "CVE-2025-44005"
+  ],
+  "summary": "Step CA Has Authorization Bypass in ACME and SCEP Provisioners",
+  "details": "## Summary\n\nA security fix is now available for Step CA that resolves a vulnerability affecting deployments configured with ACME and/or SCEP provisioners.\nAll operators running these provisioners should upgrade to the latest release (`v0.29.0`) immediately.\n\nThe issue was discovered and disclosed by a research team during a security review. There is no evidence of active exploitation.\n\nTo limit exploitation risk during a coordinated disclosure window, we are withholding detailed technical information for now. A full write-up will be published in several weeks.\n\n---\n\n## Embargo List\n\nIf your organization runs Step CA in production and would like advance, embargoed notification of future security updates, visit https://u.step.sm/disclosure to request inclusion on our embargo list.\n\n---\n\n## Acknowledgements\n\nThis issue was identified and reported by Stephen Kubik of the Cisco Advanced Security Initiatives Group (ASIG)\n\n---\n\nStay safe, and thank you for helping us keep the ecosystem secure.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/smallstep/certificates"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.29.0"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 0.28.4"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/smallstep/certificates/security/advisories/GHSA-h8cp-697h-8c8p"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/smallstep/certificates/commit/1011f5f5408b470a636f583bf74c0d7bbaf75d72"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/smallstep/certificates"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-306"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-12-03T17:00:03Z",
+    "nvd_published_at": null
+  }
+}

…-mcxq-54f4-mmx5/GHSA-mcxq-54f4-mmx5.json …-mcxq-54f4-mmx5/GHSA-mcxq-54f4-mmx5.jsonadvisories/unreviewed/2025/12/GHSA-mcxq-54f4-mmx5/GHSA-mcxq-54f4-mmx5.json renamed to advisories/github-reviewed/2025/12/GHSA-mcxq-54f4-mmx5/GHSA-mcxq-54f4-mmx5.json advisories/unreviewed/2025/12/GHSA-mcxq-54f4-mmx5/GHSA-mcxq-54f4-mmx5.json renamed to advisories/github-reviewed/2025/12/GHSA-mcxq-54f4-mmx5/GHSA-mcxq-54f4-mmx5.json

@@ -1,14 +1,44 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-mcxq-54f4-mmx5",
-  "modified": "2025-12-02T21:31:31Z",
+  "modified": "2025-12-03T16:59:21Z",
   "published": "2025-12-02T21:31:31Z",
   "aliases": [
     "CVE-2025-65657"
   ],
+  "summary": "FeehiCMS Has a Remote Code Execution via Unrestricted File Upload in Ad Management",
   "details": "FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management. FeehiCMS version 2.1.1 allows authenticated remote attackers to upload files that the server later executes (or stores in an executable location) without sufficient validation, sanitization, or execution restrictions. An authenticated remote attacker can upload a crafted PHP file and cause the application or web server to execute it, resulting in remote code execution (RCE).",
-  "severity": [],
-  "affected": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "feehi/cms"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "2.1.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
@@ -21,13 +51,20 @@
     {
       "type": "WEB",
       "url": "https://github.com/kiwi865/CVEs/blob/main/CVE-2025-65657.md"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/liufee/cms"
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "cwe_ids": [
+      "CWE-20",
+      "CWE-77"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-12-03T16:59:21Z",
     "nvd_published_at": "2025-12-02T21:15:53Z"
   }
 }